Exploitation ongoing with high activity in latest observed window (3 mentions)
Recommended action window: Immediate (within 24h)
NVD description
A vulnerability in GRASSMARLIN v3.2.1 allows crafted session data to trigger improper handling of XML input, which may result in unintended exposure of sensitive information. The flaw stems from insufficient hardening of the XML parsing process.
Priority
HIGH
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-04-28 | 2 | Disclosure2 |
| 2026-04-29 | 3 | Disclosure1PoC2 |
| 2026-04-30 | 1 | Patch1 |
| 2026-05-27 | 2 | Disclosure2 |
| 2026-05-28 | 3 | Active Exploitation1Disclosure1General1 |
Functional POC for Grassmarlin CVE 2026-6807 https://github.com/SecTestAnnaQuinn/Grassmarlin-CVE-2026-6807-XXE-POC/tree/main
Post summary
A functional PoC and GitHub repository for the CVE-2026-6807 XXE vulnerability in Grassmarlin have been released.
TL;DR The NSA's retired GrassMarlin OT network analysis tool—once a cornerstone of industrial control system defense—now leaks sensitive ICS/SCADA discovery data via an unpatched XML External Entity (XXE) vulnerability (CVE-2026-6807, CVSS 5.5). CISA issued ICS Advisory…
Post summary
The NSA’s retired GrassMarlin OT network analysis tool is being actively abused in the wild through an unpatched XML External Entity vulnerability, leaking sensitive SCADA discovery data.
The Tool That Was Meant to Protect Became the Weapon: GrassMarlin XXE Data Theft (CVE-2026-6807) On April 29, 2026, CISA flagged CVE-2026-6807, an XXE vulnerability in GrassMarlin, the now-archived open-source OT network visualization and analysis tool originally…
Post summary
The article reports CISA’s flagging of CVE‑2026‑6807, an XXE vulnerability in the GrassMarlin tool that could lead to data theft. No exploitation details, patches, or PoC references are provided.
CVE-2026-6807 · 5.5 The Tool That Was Meant to Protect Became the Weapon: GrassMarlin XXE Data Theft (CVE-2026-6807)
Post summary
The snippet references CVE-2026-6807, highlighting an XXE-based data theft flaw in GrassMarlin, but provides no details on exploitation or patches.
TL;DR CISA issued ICS Advisory ICSA-26-118-01 for CVE-2026-6807, a critical XML External Entity (XXE) vulnerability in GrassMarlin, an OT network analysis tool developed and open-sourced by the NSA. The tool reached end-of-life in 2017 with no vendor patch forthcoming. A…
Post summary
The CISA advisory announces a critical XXE vulnerability (CVE‑2026‑6807) in the obsolete NSA tool GrassMarlin, noting the lack of a vendor patch.
CVE-2026-6807 · 5.5 The Tool That Cannot Be Fixed: GrassMarlin XXE Exposes NSA's Archived OT Security Weapon to Data Theft
Post summary
The snippet announces CVE-2026-6807, an XXE vulnerability in GrassMarlin, highlighting its potential to expose NSA’s archived OT security weapon to data theft, without providing proof‑of‑concept details, exploitation tools, or patches.
BREAKING: CISA warns CVE-2026-6807 in NSA GrassMarlin tool enables XXE data theft in all versions, with public PoC and no patches as the product went EOL in 2017. https://threatcluster.io/cluster/cisa-warns-of-data-theft-vulnerability-in-nsas-grassmarlin-t-c7657dd4
Post summary
CISA has issued a warning about CVE-2026-6807, an XXE data‑theft flaw in NSA GrassMarlin with a public PoC available, but no patch exists because the product is EOL.
🔒 #CyberSecurity CVE-2026-6807: NSA GRASSMARLIN XXE Vulnerability — Detection and Hardening Guide "CISA flags NSA GRASSMARLIN (CVE-2026-6807) for…" 🔍 Full article at http://securityarsenal.com — search the title #CyberSecurity #ThreatIntel #mdr #threathunting #endpointdetection
Post summary
The text announces CISA’s flagging of CVE-2026-6807 (NSA GRASSMARLIN XXE) and supplies a detection and hardening guide, providing mitigation steps but no exploit or patch details.
TRC analysis shows attackers can exploit CVE-2026-6807 in NSA GRASSMARLIN to access sensitive files through XXE injection. The discontinued ICS mapping tool enables credential extraction and potential lateral movement within industrial networks. Runtime segmentation helps contain post-compromise activity in critical infrastructure. 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/nsa-grassmarlin-cve-2026-6807-xxe-vulnerability #ICS #CloudSecurity
Post summary
Researchers disclose an XXE vulnerability (CVE-2026-6807) in NSA GRASSMARLIN that could enable attackers to read sensitive files via injected XML.
CVE-2026-6807 XML Parsing Vulnerability in GRASSMARLIN v3.2.1 Causes Information Disclosure https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-6807
Post summary
The snippet announces CVE-2026-6807, an XML parsing flaw in Grassmarlin v3.2.1 that can lead to information disclosure, without mentioning PoC, exploitation, or patches.
CVE-2026-6807 A vulnerability in GRASSMARLIN v3.2.1 allows crafted session data to trigger improper handling of XML input, which may result in unintended exposure of sensitive info… https://www.cve.org/CVERecord?id=CVE-2026-6807
Post summary
The text announces CVE-2026-6807, describing an XML input handling flaw in GRASSMARLIN v3.2.1 that could expose sensitive information, but provides no PoC, exploit, or mitigation details.